Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISA 4.0 - ISACA > CISA Review > Flashcards

CISA Review Flashcards

1
Q

DDOS

A

Such attacks are contreally initiated and involve the use of multiple compromised computers. The attacks work by fuloding the target site with spurious data, thereby overwhelming the network and other related resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Cheif information security officer

A

A senior level corporate official responsible for articulating and enforcingthe policies that companies uses to protect their information assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

CISO is a much broader roll than a chief security officer (CSO ) who is normally only responsible fro pysical security within the organization

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

DAC ( descritionary access control ) cannot override MAC ( Mandatory access control ) , DAC is an additional filter, prohibiting still more access wtih the same exclusionary principle

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

cyber criminals take advantage of existing gap in the legislation of different countries when planning syber attacks in order to avoid posecution

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Crackers

A

Person who try to break the security of and gain access to somone else system without being invited to do so

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

DOS, Haking

A

Target of attack - Specfiic computer, Source of attack Computer is the object of crime. Prepetrator uses another computer to launch attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Fraud, Unauthorized access, Phishing, Installing key loggers

A

Computer is the tool of crime. Target is data or information stored in the computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Social engineering methods

A

Computer symbolizes the crime.Target is the user of the computers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Social Engineering methods

A

Phishing, Fake websites, scam mails, Spam mails and Fake resumes for employement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Alteration attack

A

Occurs when unothorzied modification affect the integrity of the data or code. Cryptographic hash is a primary defense against alteration attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Botnets

A

Comprise a collection of compromised computers ( called zombie computers) running software, usually installed vaia worms, Torjan horses or back doors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

DOS Attack

A

Examples: Smurt attack, Ping flood, SYS Flood, Teadrop attack, peer to peer attack, Permanant Denial of service attack, Application level flood attack, Nuke, DDOS, Reflected attack,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Smurf attack

A

Occurs when misconfigured network devices allow packets to be sent toall hosts on a particular network viea the broadcast address of the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Ping flood

A

Occurs when the target system is overwhelmed with ping packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

SYS Flood

A

send a flood of TCP/SYN packts with forged sender address, causing half open connections and saturates available connections cpacity of the target machine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Teadrop attack

A

Involves sending mangled IP fragments with overlapping, oversized payloads to the target machine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Banana attack

A

Redirects outgoaing messages from the client back onto the client, preventing outside access, as well as flooding the client with the sent packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Reflected attack

A

Involves sending forged requests to a large number of computers that will reply to the request. Thesource IP address is spoofed to that of the targeted victime, causing the replies to flood

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Email spoofing

A

A user receives an email message that appears tohae originated from one source but actually was sent from another source.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Flooding

A

A denial of service attack gthat brings down network or service by folloding it with large amount of traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Trap doors

A

Commonly called back doors. Bit of code embedded in program by programmers to quickly gain access during the testing or debugging phase.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Masquerading

A

An active attack in which the intruder present an identity other than the original identity. Impersonation both by people and machines fall under this category. Masquerading by machine ( also called as IP spoofing ) - A forged IP address is presented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Packet replay

A

A combination of passive and active mode of attack. This form of attack is effective particularly where the receiving end of the communicationchannel is automated and will act on receipt and interpretation of the information packets without human intervention

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Phishing

A

The criminally fraudulent process of attempting to acquire sensitive information, such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Spear Phishing

A

A pinpoint attack against a subset of people to undermine a company or organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Pharming

A

An attack that aminsn to redirect the traffic of a web site to a bogus web site. It can be conducted either by changing the hoset file on a victims computer or by exploiting a vulnerability in DNS server software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Social engineering

A

The human side of breaking into computer system

29
Q

Piggybacking

A

act of following authorized person through a secured door or electronically attaching to authorized telecommunication link.

30
Q

Piggybacking is considered a physical access exposure

A

TRUE

31
Q

Race conditions

A

Also knows as Time of Check (TOC). Time of Use (TOU) attack. Exploit a small windo of time between the time that security control is applied and time that the service is used.

32
Q

carfule programming and good administration practices help to reduce race conditions

A

TRUE

33
Q

Resource Enumeration and Browsing

A

When the attacker lists the various resources on targeted hosts and networks. Browsing a form of rresource enumeration attack and is preformed by a manual search.

34
Q

The difference between the rounding down technique and salami technicuq is that in rounding down, the program rounds off by the smallest money fraction, whereas salami technique truncate last few digits

A

TRUE

35
Q

War chalking

A

The practice of marking a series of symbols on sidewalks and wall to indicate nearby wireless access points

36
Q

War walking

A

Similar to war driving, but a vehicle is not used. The potential hackers walk around the vicinity with handheld device or PDA

37
Q

War driving

A

The practice of driving around businesses or residential neighborhoods while scanning with a notebook computer, hacking toold software and sometimes with a global positioning system to serarch for wireless netowrk names

38
Q

Another risk of peer to peer computing is that users may expose there IP addresses, which can lead to IP spoofing

A

TRUE

39
Q

THe postincident review phase shoudl determine which vulnerabilities were not addressed and why and input provieded for improvment to the policies and procedures implemented to address vulnerabilities

A

TRUE

40
Q

wire tapping

A

involves eavesdroppingon information being transmitted over telecommunication lines

41
Q

Authentication is typically categorized as “something you know” PASSWORD. Somthing you have “TOKEN CARD” and something you are “BIOMETRIC FEATURES”

A

TRUE

42
Q

Initial password may be allocated by security administrator or generated by the system itself

A

TRUE

43
Q

Firecall ID

A

Practices such as keeping the administrator passoword in a sealed envelope, kept in a locked cobinate and available only to top managers, should be implemented

44
Q

The main disadvantage comparerd to other biometris methods is the lackof uniqueness of hand geometry data

A

TRUE

45
Q

Advantage of Iris identification

A

the contact with the device is not needed

46
Q

Disadvantage of Iris identification

A

high cost of system, as compared to other biometric technologies and the high amount of storage requirements needed to uniquely identify a user

47
Q

Retina scan is extremely reliable and it has the lowest fales-acceptance rate among the current biometric methods

A

TRUE

48
Q

Disadvantage of retina scanning

A

includes the need for fairly close physical conact with scanning device, which impairs user acceptance, and the high cost

49
Q

The main disadvantage of face recongintion is the lack of uniqueness, which means that people who look like may fool the device

A

TRUE

50
Q

The main disadvantage is capturing the uniqueness of a signature particularly when a user does not sighn his / her name in a consistent manner

A

TRUE

51
Q

Disadvantage of VPN

A

lack of central authority and can be difficult to troubleshoot

52
Q

A good practice will terminate all VPN to the same end point in a so called VPN concentrator, and will not accept VPNs directed at other parts of the network

A

TRUE

53
Q

The drawback of an IPS is that it may inadvertently block legitimate traffic

A

TRUE

54
Q

Which of the following attacks targets the Secure Socket Layer SSL

A

Man in the middle

55
Q

which of the following virus prevention techniques can be implemented through hardware

A

remote booting

56
Q

Example of deterrance

A

installation of firewalls for information systems

57
Q

while reviewing the business continuity plan of an organization, an IS auditor observed taht the organization data and software files are backed up on a periodic basis which characteristic of an effective plan does this demonstrate

A

mitigation

58
Q

MAO is the maximum amount of system downtime that is tolerable. It is used as synanym for RTO. However RTO denotes an objectiv/target, while MAO constitutes a vital necessity for an organisations survival

A

TRUE

59
Q

A redundancy check

A

detect transmission errors by appending calculated bit on to the end of each segment of data

60
Q

A resonableness check

A

compares data to predefined reasonability limit or occurrence rates established for the data

61
Q

A parity check

A

is a hardware control that detects data errors when data are read from one computer to another, from memory or during transmission

62
Q

check digit

A

detects transpostion or transcription errors

63
Q

WEP has been shown to be a very weak encryption technique and can be cracked within a minute

A

TRUE

64
Q

which of the following encryption techniques will best protect a wireless network froma man in the middle attack

A

Randomly generated pre shared key PSK

65
Q

system logs are automated reports which identify most of the activities performed on the computer

A

TRUE

66
Q

operation problem reports are used by operator to log computer operation problems

A

TRUE

67
Q

order or DRP

A

1 BIA 2 develop recovery strategies 3 Develop specific plan 4 tested and implemented

68
Q

Applying a cryptographic hashing algorithm the entire message addresses the message integrity issue. Enciphering the message digest using the senders private key address non repidiation. Encrypting the message with a symmetric key, thereafter allowing the key to be enciphered using the receivers public key most efficiently address the confidentiality of the message as well as the receiver’s non repudiation

A

TRUE

CISA 4.0 - ISACA (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions